8e9985c72e
restructured yaml
2026-03-09 21:33:49 +05:30
2654d5c1bd
fix rc4 false negative in #1043
2026-03-09 19:56:07 +05:30
Devarjya
2a55a30478
Refine Speck detection using variant-specific rotation constants ( #1115 )
2026-02-17 14:18:46 -07:00
Willi Ballenthin
6a0d506713
add encrypt-data-using-hc-256 ( #1097 )
2026-01-06 10:01:44 -07:00
Still / Azaka
7269873b0c
Add rules for detecting donut-related features ( #997 )
...
* Initial additions for detecting donut features
Signed-off-by: Still Hsu <dev@stillu.cc>
* Lint rules
Signed-off-by: Still Hsu <dev@stillu.cc>
* Update ATT&CK for donut rule
Signed-off-by: Still Hsu <dev@stillu.cc>
* Fix comment for dynamic scope on donut loader
Signed-off-by: Still Hsu <dev@stillu.cc>
* Require at least one donut function match for donut rule
Signed-off-by: Still Hsu <dev@stillu.cc>
* Add offset for examples
Signed-off-by: Still Hsu <dev@stillu.cc>
* Add indirect call for IAssembly matching
Signed-off-by: Still Hsu <dev@stillu.cc>
* Match known vtable offsets for assembly loading
* Remove loop matching
---------
Signed-off-by: Still Hsu <dev@stillu.cc>
2025-03-21 10:15:28 -06:00
Mike Hunhoff
75c16e4b14
remove redundant matches for dynamic scope ( #987 )
...
* remove redundant matches for dynamic scope
* fix lints
* fix lints
* tighten scopes
2025-02-04 09:32:24 +01:00
Willi Ballenthin
c1d20764ad
use "span of calls" scope ( #973 )
...
* use sequence scope instead of thread scope for "static: function" rules
* use sequence scope instead of thread scope for "static: basic block" rules
* make runtime linking rules more concise
* doc: describe sequence scope
* rename "sequence" scope to "span of calls" scope
* Update anti-analysis/anti-av/check-for-sandbox-and-av-modules.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/get-geographical-location.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/file-managers/gather-classicftp-information.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/wmi/reference-wmi-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
* Update collection/database/sql/reference-sql-statements.yml
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
---------
Co-authored-by: Mike Hunhoff <mike.hunhoff@gmail.com>
2025-01-29 10:27:13 +01:00
Ana María Martínez Gómez
70851020c5
New rules: RSA & bigint ( #982 )
...
* Add use-bigint-function
Add new `data-manipulation/encryption/use-bigint-function.yml` rule to
identify bigint functions as these functions may help reverse engineers
identifying crypto. Example of bigint functions identified by this rule:
- `bi_copi`
- `bi_permanent`
- `bi_depermant`
- `bi_free`
Reference:
- 147d69429b/src/bigint.c3e9b57d82a/src/crypto/bigint.c147d69429b/src/rsa.c (L232)3e9b57d82a/src/crypto/rsa.c (L233)
2025-01-21 11:36:04 -07:00
mr-tz
7acd83194e
tighten scopes
2024-10-25 08:28:16 +00:00
Takahiro Haruyama
4170f3c8d3
Update HC-128 (variation used in Winnti malware)
2024-07-25 12:26:53 +09:00
JJ
7f8216f2f2
Update encrypt-data-using-dpapi.yml rule ( #900 )
...
* Update encrypt-data-using-dpapi.yml rule
2024-05-21 09:58:07 +02:00
Daniel Stepanic
c454ffb661
Create encrypt-data-using-rc4-via-systemfunction033.yml ( #890 )
...
* Create encrypt-data-using-rc4-via-systemfunction033.yml
Similar to SystemFunction032, this undocumented API allows encryption/decryption using RC4 algo
2024-04-22 10:32:38 +02:00
mr-tz
305adfd16b
graduate rule from nursery
2023-11-24 11:53:19 +01:00
mr-tz
e18704545a
fix call/thread scopes manually
2023-11-24 11:35:00 +01:00
mr-tz
784c9dca53
upgrade rules using updated script
2023-11-24 11:34:28 +01:00
Moritz
e44f57c035
AES MixColumns detection ( #749 )
...
* add rule
2023-04-25 21:18:51 +02:00
Moritz
54d357a201
Update reference-public-rsa-key.yml ( #745 )
2023-04-17 09:59:19 -06:00
raymondlleong
32dc1ea9e8
Adding rules for TEA, XTEA, XXTEA and RIPEMD hashing ( #700 )
...
* Adding rules for TEA, XTEA, XXTEA and RIPEMD hashing
Adding to current rules for TEA encrypt & decrypt
Adding rules for XTEA, XXTEA, RIPEMD-128, 160, 256, 320
* Description edited for clarity
* byte pattern correction
* updates
- rules with examples moved out of nursery
- unneeded examples removed from rules and their example files removed from the PR for capa-testfiles
- DS_store files deleted
- Descriptions edited to reflect shared magic constants with SHA1
* ripemd128 update
updated to include magic array not present in MD5
* MD5 & SHA1 documentation update + RIPEMD160 removal
Updating MD5 & SHA1 rules to document magic constants shared with other hashing routines.
Removing RIPEMD160 rule using magic constants due to likelihood of false positives with SHA1 routines
* ripemd320 description update
2023-03-14 08:33:42 +01:00
Moritz
106123eb61
Rules for the week ( #671 )
...
* add rules
* avoid FPs via mnemonics to ignore
* correct number logic
* add --onefile option strings
2023-01-27 09:56:12 +01:00
Willi Ballenthin
07c10dd26b
des: add more constants from libtomcrypt
2023-01-24 12:13:46 +01:00
Moritz
2a997f5d0c
add upper limit for basic block count ( #661 )
...
* add upper limit for basic block count
Co-authored-by: Willi Ballenthin <willi.ballenthin@gmail.com>
2023-01-19 13:11:45 +01:00
Willi Ballenthin
f59538a9e2
rc5/6: more constants
2023-01-19 11:37:32 +01:00
Matt Williams
48b71adb35
Update encrypt-data-using-curve25519.yml
2023-01-11 14:10:54 -05:00
Mike Hunhoff
96a1abddca
new/update .NET rules ( #625 )
2022-10-07 09:39:57 -06:00
johnk3r
3f298900d4
use .NET libraries ( #612 )
...
* Add files via upload
https://github.com/mandiant/capa-rules/issues/609
* Update load-suspicious-libraries.yml
* Delete load-suspicious-libraries.yml
* Create load-suspicious-libraries.yml
* Update load-suspicious-libraries.yml
* Update load-suspicious-libraries.yml
* embed dependencies as resources using Fody/Costura
https://github.com/mandiant/capa-rules/pull/612
* Delete embed-dependencies-as-resources-using-fody-costura.yml
* embed-dependencies-as-resources-using-fody-costura
https://github.com/mandiant/capa-rules/pull/612
* Rename embed-dependencies-as-resources-using-fody-costura.yml to embed-dependencies-as-resources-using-fodycostura.yml
* use-dotnet-library-encryptdecryptutils
https://github.com/mandiant/capa-rules/pull/612
* use-dotnet-library-newtonsoft.json
https://github.com/mandiant/capa-rules/pull/612
* use-dotnet-library-sharpclipboard
https://github.com/mandiant/capa-rules/pull/612
* use-dotnet-library-sharpvectors
https://github.com/mandiant/capa-rules/pull/612
* Delete load-suspicious-libraries.yml
* Rename use-dotnet-library-newtonsoft.json.yml to use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-encryptdecryptutils.yml
* Update use-dotnet-library-sharpclipboard.yml
* Rename anti-analysis/obfuscation/use-dotnet-library-encryptdecryptutils.yml to data-manipulation/encryption/aes/use-dotnet-library-encryptdecryptutils.yml
* Rename nursery/use-dotnet-library-newtonsoftjson.yml to data-manipulation/json/use-dotnet-library-newtonsoftjson.yml
* Rename nursery/use-dotnet-library-sharpvectors.yml to data-manipulation/svg/use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-sharpclipboard.yml
* Update use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-encryptdecryptutils.yml
* Update use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-encryptdecryptutils.yml
* Update embed-dependencies-as-resources-using-fodycostura.yml
* Update use-dotnet-library-encryptdecryptutils.yml
* Update use-dotnet-library-sharpvectors.yml
* Update use-dotnet-library-newtonsoftjson.yml
* Update use-dotnet-library-sharpclipboard.yml
2022-08-29 18:49:40 +02:00
Mike Hunhoff
ac4a9edb3b
rules: fix invalid rule metadata
2022-08-11 16:12:49 -06:00
Willi Ballenthin
57e1732f5c
Revert "Revert "Merge pull request #548 from mandiant/feature-remove-flavors""
...
This reverts commit d43a6ee544
2022-06-28 15:23:20 -06:00
Willi Ballenthin
3fc7309b5c
Merge branch 'master' into existing-dn-rules
2022-06-28 14:06:51 -06:00
Willi Ballenthin
d62ed7f2d9
rename .NET rule paths
2022-06-28 11:08:54 -06:00
Willi Ballenthin
3152b98ccd
use .NET features for existing .NET rules
2022-06-06 15:56:31 -06:00
Willi Ballenthin
20c46c64c8
Merge pull request #562 from ryantxu1/master
...
Update Mappings for MBC (part 8)
2022-06-03 11:15:49 -06:00
ryan
92eef819bb
Update Mappings for MBC (part 8)
2022-06-03 09:43:39 -05:00
Willi Ballenthin
88c9c786ca
*: use meta.authors everywhere
2022-05-26 11:56:31 -06:00
idiom
49ac35dbe7
Update rules to use a list item instead of a string value for references.
2022-05-11 10:39:42 -04:00
William Ballenthin
d43a6ee544
Revert "Merge pull request #548 from mandiant/feature-remove-flavors"
...
This reverts commit bc28847dd982308c4109
2022-04-27 06:23:36 -06:00
Willi Ballenthin
904bf3ef00
*: remove /x32 and /x64 flavors and use instruction scope
2022-04-05 12:25:14 -06:00
htnhan
cae4aa28ae
Issue #539 : Sample manually build AES/Rijndael boxes
2022-03-14 14:01:07 -05:00
Zander Work
ee10f6eaa4
add linux requirement
2021-10-24 18:13:50 -04:00
Zander Work
0d83ae971c
Add glibc memfrob rule
2021-10-23 03:40:55 -04:00
Moritz Raabe
25938ca10c
change to mandiant.com
2021-09-28 12:21:11 +02:00
MalwareMechanic
b2f28af082
update reference link and change comments to descriptions
2021-08-24 12:29:42 -04:00
MalwareMechanic
92d4dd931d
udpate comment
2021-08-24 12:21:38 -04:00
MalwareMechanic
8ee20678aa
udpate email
2021-08-24 12:21:00 -04:00
MalwareMechanic
18804adef9
add rule for WolfSSL HC-128 encryption algorithm
2021-08-24 12:19:34 -04:00
Willi Ballenthin
656de6b7bd
create new key via CryptAcquireContext: tweak DLL name for CryptAcquireContext
2021-08-18 15:12:21 -06:00
Chuong Dong
e97867d227
Fix api and remove example
2021-07-19 13:55:57 -07:00
Chuong Dong
30b68fda00
Add rule for CryptAcquireContext CRYPT_NEWKEYSET
2021-07-19 12:32:51 -07:00
William Ballenthin
5b9f0f0787
graduate "get outbound credentials handle via CredSSP"
2021-06-08 10:08:42 -06:00
Andrew
fbafd732e7
Update rule metadata for rules written by @recvfrom
...
Mostly just changes @recvfrom to awillia2@cisco.com , but
also updates the descriptions in a few places to be
more precise (I don't think I initially realized that
`api` has function scope and is for API calls whereas
`import` has file level scope and is just for the import)
2021-06-06 23:30:34 -04:00
William Ballenthin
554ffb2139
encrypt aes via x86: remove example and move to nursery
2021-05-18 13:37:40 -06:00
